Least Privilege, but Only for Humans
Attackers used the credential of the ConnectWise Cloud Backup app to sign in to more than 300 Microsoft 365 tenants, with no user and no MFA. Why our diligence with users stops at enterprise apps, and what actually helps.